top | item 44685260

Data shows public AI repos may be quietly becoming a supply chain risk

7 points| ersatz_username | 7 months ago |blog.ramalama.com

1 comment

order

ersatz_username|7 months ago

We analyzed over 1.8 million Hugging Face model repositories and found widespread licensing ambiguity, risky serialization formats, and subtle file-level inconsistencies—including drift between declared and actual artifact content. Even among the most-downloaded models, a surprising number are missing licenses or contain flagged files. Curious how others are thinking about model integrity and compliance in production.